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Abstract. Considered is the distribution of the crosscorrelation be- 
tween m-sequences of length 2 m — 1, where m = 2k, and m-sequences 
of shorter length 2 fc — 1. New pairs of m-sequences with three- valued 
crosscorrelation are found and the complete correlation distribution 
is determined. Finally, we conjecture that there are no more cases 
with a three- valued crosscorrelation apart from the ones proven here. 
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1 Introduction 

Let {at} and {bt} be two binary sequences of length n. The crosscorrelation 
function between these two sequences at shift r, where < r < n, is defined by 

n-l 

c(t) = j2(-i) at+bt+T ■ 

t=0 

If the sequences {at} and {bt} are the same we call it the autocorrelation. 

Sequences with good correlation properties are important for many applica- 
tions in communication systems. A relevant problem is to find the distribution of 
the crosscorrelation function (i.e., the set of values obtained for all shifts) between 
two binary m-sequences {s t } and {sdt} of the same length 2 m — 1 that differ by a 
decimation d such that gcd(d, 2 m — 1) = 1. A survey of some of the basic research 
on the crosscorrelation between m-sequences of the same length can be found in 
Helleseth [1] and more recent results in Helleseth and Kumar |2j and Dobbertin 
et. al. [3j. A basis for many applications is the family of Gold sequences with 
their three- valued crosscorrelation function. 

In a recent paper [3], Ness and Helleseth studied the crosscorrelation between 
an m-sequence {st} of length n = 2 m — 1 and an m-sequence {udt} of length 2 fc — 1, 
where m = 2k and gcd(d, 2 k — 1) = 1. Here {ut} denotes the m-sequence used 
in constructing the small family of Kasami sequences [5]. Recall that this family 
consists of 2 k sequences {s t } + {u t + T } for r = 0, . . . , 2 fe — 2 plus the sequence 
{s t }, where s t and u t are defined in (CQ) and (j2J). For the Kasami sequences, the 
crosscorrelation between {st} and {ut} takes on only two different values. It is 
an open problem whether this is possible in other cases. Numerical results show 
several pairs of m-sequences with three-valued crosscorrelation function between 
{s t } and {u^}, where gcd(d, 2 k — 1) = 1 and k is odd. In addition to general 
results, Ness and Helleseth proved in [4] that the decimation d = ^-±1 gives a 
three-valued crosscorrelation distribution and in [5] they proved the same distri- 
bution for d = 2( fc+1 )/ 2 - 1 (in both cases k odd is needed). In this paper, we 
cover all the cases found by computer experiments that lead to a three-valued 
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crosscorrelation distribution and completely determine this distribution. Speak- 
ing concretely, the decimation d such that d(2 l + 1) = 2* (mod 2 k — 1) for some 
integer I and i > with gcd(/, k) = 1 and odd k gives a three-valued crosscorre- 
lation distribution. We conjecture that there are no other three-valued cases but 
these. This result includes the decimations proved in [H [6] as a particular case 
that is obtained assuming I = 1 and I = ^p. 

In Section [21 we present preliminaries needed for proving our main result. In 
Section [3], we analyze zeros of a particular affine polynomial A a (v). In Section HJ 
we find the distribution of the number of zeros of a special linearized polynomial 
L a (z). These two polynomials play a crucial role in finding the distribution of a 
new three- valued crosscorrelation function. In Section [51 we determine completely 
the crosscorrelation distribution of the new three-valued decimation. 



2 Preliminaries 

Let GF(q) denote a finite field with q elements and let GF(g)* = GF(q) \ {0}. 
The trace mapping from GF(g m ) to GF(g) is defined by 

m— 1 

Tr m (x) = ^x ql . 

i=0 

Let GF(2 m ) be a finite field with 2 m elements and m = 2k with k odd. Let 
a be an element of order n = 2 m — 1. Then the m-sequence {s t } of length n can 
be written in terms of the trace mapping as 

st = Tr m (a*) . (1) 

Let (3 = a 2 +1 , then f3 is an element of order 2 k — 1. The sequence {u t } of length 
2 k — 1 (which is used in the construction of the well-known Kasami family) is 
defined by 

u t = Tr fc (/5') . (2) 

In this paper, we consider the crosscorrelation between the m-sequences {s t } 
and {v t } = {udt} at shift r defined by 

n-l 

= J2(-l) St+Vt+T > (3) 
t=o 

where gcd(d, 2 k — 1) = 1 and r = 0, . . . , 2 k — 2. One should observe that in this 
setting, by selecting all decimations d with this condition, we cover the cross- 
correlation function between all pairs of m-sequences having these two different 
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lengths. Using the trace representation, this function can be written as an expo- 
nential sum 



n-l 



x&GF(2 m )* 



Since the two subgroups of GF(2 m )* of order 2 k — 1 and 2 k + 1, respectively, 
only contain the element 1 in common, it is straightforward to see that for any 
element, say a~ T G GF(2 m )*, there is a unique element u, where u 2 +1 = 1 such 
that a~ T u = a G GF(2 fe )*. Further, distinct values of r = 0, 1, . . . , 2 k - 2 lead to 
distinct values of a G GF(2 fc )*. Further, note that for any u with u 2 +1 = 1 we 
have 

xeGF(2 m )* xeGF(2 m )* 

Therefore, the set of values of Cd{r) + 1 for all r = 0, 1, . . . , 2 k — 2 is equal to the 
set of values of 

5(a) = ^ ( _ 1) Tv m w+^ l (^ ( 4 ) 

xeGF(2 m ) 

when a G GF(2 fe )*. 

The main result of this paper is formulated in the following corollary that 
gives a three-valued crosscorrelation function between new pairs of sequences of 
different lengths. This corollary immediately follows from Theorem [2J 

Corollary 1 Let m = 2k and d{2 1 + 1) = T (mod 2 k — 1) for some odd k and 
integer I with < I < k, gcd(l,k) = 1 and i > 0. Then the crosscorrelation 
function C&{t) has the following distribution 

— 1 — 2 k+1 occurs 2k g" 1 times , 

— 1 occurs 2 k ~ 1 — 1 times , 
— 1 + 2 k occurs ^jl times . 

The result will be proved in a series of lemmas. The outline of the proof is 
as follows. We have shown that we can write Cd(r) + 1 for r = 0, 1, . . . , 2 k — 2 
as an exponential sum S(a) for a G GF(2 fc )*. In the case when / is even, we 
can calculate the distribution of this sum directly as an exponential sum S (a) 
and obtain the result. In the case when / is odd, a different approach works. In 
this case, we need some r being a noncube in GF(2 m ) such that r 2 +1 = 1 (for 
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instance, we can take r = a 2 1 with a a primitive element of GF(2 m )) and we 
show that 

S(a) = (S (a) + S 1 (a)+S 2 (a))/3 
for three exponential sums So (a), Si (a) and 82(a) defined by 

Si ( a )= (-l) Tr -^^ +1 ) +Trfe ^ 2fc+1 ) for i = 0,l 

?/eGF(2 m ) 
•yGGF(2 m ) 



NTr m (r-W i + 1 )+Tr fe ( ? /+ 1 ) 



We determine S (a) exactly in Corollary [2] and find Si (a) 2 (that is equal to 
S 2 (a) 2 ) in Lemma Since S(a) is an integer, we can resolve the sign ambiguity 
of Si (a) and S 2 (a). In order to determine S (a) we need to consider zeros in 
GF(2 fc ) of the affine polynomial 

A a (v) = a 2l v 22 ' + v 2 ' + av + 1 

and this is done in Section [31 To determine the square sums Si (a) 2 and S2(a) 2 
we need to find the number of zeros in GF(2 m ) of the linearized polynomial 

, . 2 k + l . 2 l 2 l 2 2i 1 

L a {z) = z +r a z + raz 

and this task is completed in Section HI 

When finding the complete crosscorrelation distribution we make use of the 
following result from [1] that gives the sum of the crosscorrelation values as well 
as the sum of their squares. 

Lemma 1 ([!]) For any decimation d with gcd(d, 2 k — 1) = 1 the sum (of the 

squares) of the crosscorrelation values defined in (Tj|) is equal to 

2 k -2 



E <W = 1 ; 

T=0 

2 fc -2 

^Q(r) 2 = (2 m -l)(2 fc -l)-2 



r=0 



3 The Affine Polynomial A a (v] 

In this section, we take any k and consider zeros in GF(2 fc ) of the affine polynomial 

A a (v) = a 2l v 22 ' + v 2 ' + av + 1 , (5) 
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where I < k is an arbitrary but fixed positive integer with gcd(7, k) — 1 and 
a G GF(2 fc )*. Let also V = l' 1 (mod k). The distribution of the zeros in GF(2 fc ) 
of ([5]) will determine to a large extent the distribution of our crosscorrelation 
function. 

We need the following sequences of polynomials that were introduced by Dob- 
bertin in jTj (see also [8]): 

Ft(v) = v , 



F,(v) = v 2 ' +1 



F l+2 {v) = v* +1)l F l+1 {v) + v^^Fiv) for i > 1 , 

Gi(v) = , 

G 2 (v) = v 2 '- 1 , 
G l+2 (v) = v 2( ' +1)l G t+1 (v) + v 2( ' +1) '' 2U G t (v) for i > 1 . 

These are used to define the polynomial 

V 

R(v) = Y,^(v) + G l ,(v) . (6) 

i=l 

As noted in [7], the exponents occurring in Fj(v) (resp. in Gj{y)) are precisely 
those of the form 

3-1 

e = J2(~^ U , 

i=0 

where G {0, 1} satisfy = 0, e = (resp. e = 1) and (q, e^i) ^ (1, 1). 

Further, we will essentially need the following result proven in [3, Theorem 5] 
that the following polynomial 

is a permutation polynomial on GF(2 fc )*. (To be formally more precise, we get 
a polynomial D{v) if v~( 2 is substituted by i/ 2 _1 ) _ ( 2+1 ).) Moreover, -D(f) 
and i^f" 1 ) are inverses of each other (7J Theorem 6], i.e., for any nonzero ijG 
GF(2 fe ) with D(x) = y' 1 it always holds that R{y) = x. In and in the rest 
of the paper, whenever a positive integer e is added to an element of GF(2 fc ), it 
means that added is the identity element of GF(2 fc ) times e(mod 2). 
Also note the fact that since /'/ = 1 (mod k) then 

(2 l - 1)(1 + 2 l + 2 21 + ■ ■ ■ + 2 {l '- 1)l ) = 2 lV -1 = 1 (mod 2 k - 1) . 

Therefore, x 2t 1 = x 2 for any x G GF(2 fc ) and this identity will be used repeatedly 
further in the proofs. 
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In the following lemmas, we always assume that I < k is a positive inte- 
ger with gcd(Z, k) = 1. We also take A a (v) defined in ([5]) and R(v) defined in 
([6]). Lemmas [2] and [3] here provide generalization for Lemmas 3, 4 and 6 in [6]. 
Theorem [1] is a generalization of Lemma 7 in [6] . 

Lemma 2 For any a G GF(2 k )* the element v = R^a^ 1 ) is a zero of A a (v) in 
GF(2 k )*. 

Proof. Since D{v) in (171) is a permutation polynomial on GF(2 fc )*, then for 
any fixed a G GF(2 fc )* the equation 

v 

av 



i=l 



has exactly one solution vq = R(a 1 ) in GF(2 fc )*. Raising (JHJ) to the power of 2 l 
results in 



v+i v 



2' 2^+2' 

a v T 



j2v 2a +i'+i = Y, v2il+v2l+1+l ' +1 ■ 

i=2 i=2 

The latter identity, after being added to (IE]) and setting v = vo, gives 

2 l +l 2 l 2 2l +2 l i 2 l i 2 i+1 

av ^ = a v + v +v 
and consecutively, since vq ^ 0, A a (vo) = a 2 1 v^ 1 + v 2 + avo + 1 = 0. □ 
Lemma 3 For any a G GF(2 fc )* let z be a zero of A a (v) in GF(2 fc ). Then 

Tr fc (z) = Tr fe (w ) 

and 

Tr k (az 2l+1 ) = l'Tr k (v ) + Tr k (r + l) if z = v , 
= l'Tr k (v ) + Tr h (l') if z ^ v , 

where vo = _R(a _1 ). 

Proof. The first identity follows by observing that any zero of A a (v) is 
obtained as a sum of the zero Vq of A a (v) (see Lemma [2]) and a zero of its 
homogeneous part a 2 v 2 +v 2 +av. To prove the identity it therefore suffices to 
show that Tr k (vi) = for any V\ with a 2 v\ + v \ + av\ = 0. This follows from 

Tr fc (i;i) = Ti k (vj l+1 ) 
= Tr fc K !+2i ) 
= Tr k (a 2l vf +2 ' +avf +1 ) 
= . 
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To prove the second identity for the case when z = vq we use the fact presented 
in the proof of Lemma [2] that av^ +1 = Yj\=i v o^ + Z' + 1- Then Tr k (avQ +1 ) = 
l'Tr k (v )+Tr k (r + 1). 

Now note that since A a (v) is obtained by adding the 2*-th power of (jHJ) to 
itself we have for z ^ 

V 

A a {z) = if and only if az 2 ' +l + ^ + Z' + 1 e {0, 1} . 

i=i 

Since Vq is the only solution of (jHJ), then for z ^ v with A a (z) = we have 
az 2l+l + Y!Lx ^ + + 1 = 1 and 

Tr k (az 2l+1 ) = l'Tr k {z) + Tr k (l') = l'Tr k {v ) + Tr k (l') 

using already proved identity that Tr k (z) = Trfc(t> ). □ 
Now we introduce a particular sequence of polynomials over GF(2 fc ) and prove 
some important properties of these that will be used further for getting the main 
result of this section about zeros of A a (v). Denote 

e(i) = l + 2 l + 2 21 + ■■■ + 2^ 1 for i = 1, . . . , V 

so, in particular, e(Z') = (2 l — (mod 2 k — 1). Now take every additive term 
v e with e 7^ in the polynomial 1 + (1 + v and replace the exponent e with 
the cyclotomic equivalent number obtained by shifting the binary expansion of e 
maximally (till you get an odd number) in the direction of the least significant 
bits. We call this reduction procedure. Recall that two exponents e\ and e 2 are 
cyclotomic equivalent if 2 % e\ = e 2 (mod 2 k — 1) for some i < k. For instance, 
v Tl is reduced to v and v Tl+231 is reduced to v 1+2 3 * 1 if i < j and so on. The 
obtained reduced polynomials are denoted as Hi(v) and we use square brackets 
to denote application of the described reduction procedure to a polynomial, so 
Hi(v) = [1 + (1 + v ) e ^] for i — 1, ... ,1' . The first few polynomials in the sequence 
(after eliminating all pairs of equal terms) are 

Hi(v) = v 

H 2 (v) = [v + v 2 ' + v 1+2 ) =v + v + v 1+21 = v 1+21 

H 3 (v) = [v + v 21 + v 221 + v 1+21 + v 1+22t + v 2l+221 + v 1+2l+22l \ 

= v + v + v + + v ^ 21 + w l+2 ; + v l+*+*» =v + v l+2» + v l+2l+2» 

Lemma 4 If polynomials Hi(v) are defined as above then 

Tr k (H t (v)) = Ti k {l + (l + v) e ^) 
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for any v G GF(2 fc ) and i — 1, . . . , I'. Also let Q(v) = (xq +1 + x )v 21 + XqV + x 
for anyxo G GF(2 fc )*. Then 

Q(H l ,(xo 1 )) = (l + x )(l + XoY l ' ) ■ 

Proof. The trace identity for Hi'(v) we get obviously from the definition. 
Further, for any % G {2, ...,/'} 

Hi(v) = [l + (l + u) e «] 

where (*) follows from the following argumentation. First, note that the expo- 
nents of additive terms in v(l + u) e W _1 are exactly all 2 t ~ 1 distinct integers of 
the form 1 + t{l l + ■■■ + U^' 1 ^ 1 with tj G {0, 1} for j = 1, . . . , % - 1 and the 
reduction does not apply to any of these so 

[vil+v)^- 1 ] = v(l + vf®- 1 . 

On the other hand, the number of terms in [v 2 ^ 1)1 (1 + v) e<yl ~ 1 ^} is also equal to 
2 1 ^ 1 since the exponents in these terms are exactly all the integers of the form 
t + t 1 2 l + --- + t i _ 2 2 ii ' 2)l + 2^ 1 with tj G {0, 1} for j = 0, ...,i-2 and none of 
these become equal after the reduction. Moreover, every such an exponent, after 
reduction, can be found in v(l + i>) e W _1 so 

Also note that all terms of H^iiy) are also present in v(l +v) e ®~ 1 . Thus, the 
number of terms in H^v) that remain after eliminating all pairs of equal terms 
and denoted as #.f/j is equal to 2 i_1 — Unfolding the obtained recursive 

expression for Hi(v) starting from H\(v) = v we get that 

Hi(v) =v(l + (l + vf + (1 + vf +221 + •••+(! + v)^- 1 ) . 
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Now we can evaluate 
= (xl l+1 + x )H ll (xo 1 f + xIHi^Xq 1 ) + x 

= (so + ^o 2i+1 ) (l + (1 + + (1 + xo l f 1+231 + ■■■ + (! + x^f l+ - +2 

+ *o (l + (1 + + (1 + x?)* + *" + ■■■ + (! + xo 1 )^- 1 ) + xo 

= ((s Q + xf +1 ) + *o(l + so 1 ) 2 ') (l + (1 + x 1 ) aa + • • • + (1 + s - 1 )^+-+ 2(i '" 1)! 
+ (sq + Xo 2i+1 )(l + Xq X Y 21+ - +21 ' 1 +X + Xq 

= x {l + xtf +22l+ - +21 ' 1 

= x (l + So 1 ) 2+2i+22i+ - +2(i '' 1)i 

= (l + x )(l + x - 1 )^') 

as claimed. □ 
Lemma 5 For any a E GF(2 fc )* let x e GF(2 fc ) satisfy x 2 +1 + x = a. Then 
Tr k (l + {l + XoY V) )= r n k (R{a- 1 )) . 

Proof. Denote r = x\ ~ x + Xq 1 (obviously r ^ since xq ^ 1), A = r -6 ^ 
and further, using Lemma HJ evaluate 

Q{H v {x^))xf ) = (1 + x )(l + s ) e( ^ = (1 + x 2i ) e ^ 

and thus, Q{Hv{xq 1 )) 2 '~ 1 = T or, equivalently, 

Q{H v {x^)) = A- 1 . (9) 

In what follows, we use the technique suggested by Dobbertin for proving [71 
Theorem 1]. Note that 



A l \ 2 l 2 2i , 2 i+1 2 l i 2 ; i / 2'-l , -1\ / / 2 ! +l , \ 2 l , 2 , 

A a (f ) = a v + x v + x + [Xq + x ) ( C^o +^0)"^ + x v + x 
= Q(vf + TQ(v) = Qiv^Qivf- 1 + A^ 2 '- 1 )) 

for Xq +1 +a; = a and therefore, by (jUJ), Ai^'^o *)) = 0. Consider the equation 

g(t;) + A- 1 = (10) 

whose roots are also the zeros of A a {v). We will show that ffTUj) has exactly two 
roots with Hi^Xq 1 ) and Ri^a" 1 ) being among them (however, we do not claim 



that Ria- 1 ) ^ H^x^ 1 )). Multiplying ([TO]) by /i = (xgA)" 1 and using that 
(x 2 , +1 + x ) A 2 ' -1 = Xq gives 

+ x )v 21 + x 2 v + x + A' 1 ) = (v/A) 2 ' + v/A + x 0/ u + x\[i 2 = , 

which has exactly two solutions z = Hi^Xq 1 ) (see ®) and z x = H v (x 1 ) + A 
since its linearized homogeneous part (v/A) 2 +v/A has exactly two roots v = 

and v = A. Thus, z + z\ = A = y-^f J ' Using (x 2 , + 1) A 2 _1 = x it is easy 

to see that A 2 ' = x A + (x A) 2i and we have Tr fc (A) = 0. 

Now we show that none of the possible roots of Q(v) = is a solution of ([8]). 
In fact, suppose that Q(z) = 0. Then, since x ^ 0, we have z 2 = (x z) 2 +x z + 1 
and az 2,1 = x^z + Xq (since a = x\ +1 + x ). We put such a z into ([S]) and compute 

i' 

az *+i + J2z 2U + l' + l 

8=1 

Z'-l i' 

= (x 2 ^ + x )z + ^2(x z) 2lL + ^2(x z) 2lL + /' + /' + 1 

i=0 i=l 

= 1 . 

Therefore, recalling the proved identity A a (v) = Q(v)(Q(v) 2,l ~ 1 + A^ 2 ' -1 )) 
and keeping in mind that gcd(2' — 1, 2 k — 1) = 1 we see that Vq = i?(a _1 ) which is 
the unique solution of ([H]) and, by Lemma also the root of A a (v) = 0, satisfies 
Q(v$) = A -1 . Recall that (jT0l) has exactly two solutions 2o = Hi^x^ 1 ) and 
zi = ^/(xq^ + A. Thus, J R(a~ 1 ) + i/ F (x 1 ) = A or i2(a _1 ) = H v (x Q l ) (although 
we do not need in our proof that _R(a _1 ) ^ Hi/(xq X ), we believe that this holds) 
and, by Lemma HI 

Tr^a- 1 )) = Tt h {H v {xo x )) = Tr fe (l + (1 + x Y n ) 

as claimed. □ 

Theorem 1 For any a G GF(2 fc )* and a positive integer I < k with gcd(Z, k) = 1, 
let A a (v ) be defined as in |3]). Also let 

Mi = {a | A a (v ) has exactly i zeros in GF(2 k )} . (11) 

Then A a (v) has either one, two or four zeros in GF(2 fc ). For i G {1,2,4}, we 
have a G Mj z/ and on/y ifp a (x) = x 2 +1 + x + a /ias exactly i — 1 zeros in GF(2 fc ). 
The following distribution holds for k odd (resp. k even) 



|Mi 


2 fc +l 
3 


(resp. 


2 k -l\ 

3 / 


|M 2 | 


= 2*- 1 - 1 


(resp. 


2 *-i) 


|M 4 | 


2 fe-l_l 
3 


(resp. 


2 fc_1 -2 
3 
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Furthermore, a e M 2 if and only ifTik(R(a 1 ) + 1) = 1, where R(v) is defined 
in fifty. 

Proof. In Lemma [2] it was shown that vq = i?(a _1 ) is a zero of A a (v) in 
GF(2 fc )*. Let N a be the number of zeros of A a (v) in GF(2 fc ). Since A a (v) has 
a zero in GF(2 fc ), N a is equal to the number of zeros of its homogeneous part 
a 2 v 2 +v 2 +av in GF(2 fc ). Dividing the latter polynomial by a~ l v ) then raising 
it to power 2 k ~~ 1 and replacing (av 2 ~ 1 ) 2 by x leads to 

p a (x) = x 2l+1 + x + a , 

which, since gcd(2' — 1, 2 fc — 1) = 1, has N a — 1 zeros in GF(2 fc ). It is therefore 
sufficient to study the number of zeros of this polynomial in GF(2 fe ). 

From now on assume that N a > 2. Then p a (x) has a zero xq G GF(2 fe ). Now 
we replace x in p a (x) with x + xq to get 

(x + X ) 2l+1 + (x + Xq) + a = 



or 

x z " +i + x x z " + Xq x + Xq +1 + x + x + a = 
which implies 

x 2 ' +1 + x x 2 ' + (Xq + l)x = . 

Since x = corresponds to x being the zero of p a (x), we can divide the latter 
equation by x and after substituting y = x" 1 we note that if p a {x) has a zero 
then the reciprocal equation, given by 

(x 2 l + l)y 21 +x y + l = (12) 

has N a — 2 zeros. This affine equation has either zero roots in GF(2 fc ) or the 
same number of roots as its homogeneous part (xq + l)y 2 + x$y which is seen to 
have exactly two solutions, the zero solution and a unique nonzero solution, since 
gcd(2' — 1,2 — 1) = 1. Therefore, it can be concluded that p a (x) = can have 
either zero, one or three solutions or, equivalently, A a (v) has either one, two or 
four zeros in GF(2 fc ). 

Now we need to find the conditions when there exists a solution of f|T2|) . Let 
y = tw, where t 2 ~ l = c and c = . Since gcd(2' — 1, 2 k — 1) = 1, there is a 

one-to-one correspondence between t and c. Then ( fT2|) is equivalent to 

i 1 



w 2 + w + 



ct(x* + 1) 
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Hence, ffl2l) has no solutions if and only if 



This easily follows from the fact that the linear operator L(u) = u 2 ' + uj on 
GF(2 fc ) has the kernel of dimension one and, thus, the number of elements in the 
image of L is 2 k ~ l . Since all the elements uj 2 + u have the trace zero and the 
total number of such elements in GF(2 fc ) is 2 k ~ 1 , we conclude that the image of 
L contains all the elements in GF(2 fc ) having trace zero. 

Since c = t 2 ~ l then t = c e<yl '\ Thus, from the definition of c and t we get 




ly(l')\ 

We conclude that p a {x) has exactly one zero (which is xo) if and only if 

Tr fe ((l + x - 1 ) e ^) = l . (13) 

It means that A a (v) has exactly two zeros in GF(2 fc ) (i.e., N a = 2) only for such a 
that a = x\ +1 +Xo with (1131) holding. Combining this with the result of LemmaEl 
we conclude that A a (v ) has exactly two zeros in GF(2 fe ) if and only if 

Tr^cT 1 ) + 1) = 1 . 

In the case of one or four zeros, Tr^ii^a" 1 ) + 1) = 0. 

Now note that since e(Z') = 1 + 2 z + 2 2 'h ^2^'~ 1)z is invertible modulo 2 fc — 1 

with the multiplicative inverse equal to 2 l — 1 then gcd(e(/'), 2 k — 1) = 1 and thus, 
(1 + t!" 1 )^') is a one-to-one mapping of GF(2 fc )* onto GF(2 fc ) \ {1}. Therefore, 
if k is odd (resp. k is even) then the number of Xq G GF(2 fe )* satisfying (I13p is 
equal to 2 fc ~ 1 — 1 (resp. 2 fc_1 ) and obviously xq ^ 1. On the other hand, if N a = 2 
then x 2 +1 + x = a has a unique solution xq and so the number of nonzero values 
a e GF(2 fc )* with N a = 2 for k odd (resp. k even) is |M 2 | = 2 k - 1 - 1 (resp. 
2 k ~ 1 ). Now note that if a = then p a (x) = x 2 +1 + x + a has exactly two zeros 
x = {0,1}. Thus, considering the mapping x i— > x 2 +1 + x for x running through 
GF(2 fe )\{0, 1} it is easy to see that \M 2 \ + 3|M 4 | = 2 fe -2 and, knowing \M 2 \, we 
can find \M^\. Finally, the last remaining unknown \Mi\ can be evaluated from 
the obvious equation \M X \ + \M 2 \ + |M 4 | = |GF(2 fc )*| = 2 k - 1. □ 

Note the paper [9| by Bluher where x p +1 + ax + b and the related polynomials 
similar to the linearized part of A a (v) over an arbitrary field of characteristic p are 
studied. In particular, the possible number of zeros and corresponding values of 
|Mj|, in the notations of our Theorem!]], were found (see [9], Theorems 5.6, 6.4]). 
This was also done earlier for odd k in [10J Lemma 9]. 
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4 The Linearized Polynomial L a (z) 

The distribution of the three- valued crosscorrelation function to be determined in 
Section [5] depends on the detailed distribution of the number of zeros in GF(2 m ) 
of the linearized polynomial 

L a (z) = z 2k+l + r 2 'a 2 'z 22 ' + raz , (14) 

where a G GF(2 fc ), r G GF(2 m ) and m = 2k. Some additional conditions on 
the parameters will be imposed later. For the details on linearized polynomials 
in general, the reader is referred to Lidl and Niederreiter |llj . In the following 
lemmas, we always take L a (z) defined in ffT4l) . 

Lemma 6 Let I and k be integers with gcd(7, k) — 1, a G GF(2 fe ) and r G 
GF(2 m ). If L a (z) = for some z G GF(2 m ) then 

aTr-(r^ +1 )G{0,l} , 

where Tr™(x) = x + x 2k is a trace mapping from GF(2 m ) to GF(2 fc ). 

Proof. For any z G GF(2 m ) with L a (z) = we have 

z 2l L a (z) = raz 2l+1 + (raz 2l+1 f + z 2 '^ = 

and z 2l( - 2k+ V e GF(2 fc ). Thus, Ti%{raz 2l+1 ) + (Tr^ {raz 2 ' ' +1 )f = meaning that 
aTi^(rz 2 ' +1 ) G GF(2') n GF(2 fc ) = {0, 1}. □ 

Lemma 7 Let I and k be odd with gcd(7, k) — 1, a G GF(2 fe ) and r be a noncube 
in GF(2 m ) such that r 2 +1 = 1. Then the following holds. 

(i) The number of zeros of L a (z) in GF(2 m ) is 1 or 4. 

(ii) If, additionally, a ^ and Tik{vo) = (where Vq = -R(a _1 ) and R{v) is 
defined in ^)) then L a (z) has z = as its only zero in GF(2 m ). 

Proof. First of all, let z = z 2k for any z G GF(2 m ) and also let U = rz 2 ' +1 . 
If z and L a (z) = then, since / is odd and r is a noncube in GF(2 m ) with 
r 2 +1 = 1 we have that U ^ U and thus, by Lemma El and denoting V = all 

aTi™(U) = V + V 2 " = 1 . (15) 

(i) If a = then L a (z) has a unique zero root so we further assume that 
a ^ 0. The polynomial L a (z) is a linearized polynomial and its zeros form a 
vector subspace over GF(2) (and even over GF(2 2 ) since k + 1 is even). We will 
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study the number of solutions of L a (z) = in GF(2 m ). Note that L a (z) = is 
equivalent to 



-2 l 2 l 2 l 2 2 ' , 

z = r a z + raz 



Further, we obtain 



- j 

JJ 2 ' = r -2'-2< (2'+l) 

-2 l / 2 l 2 l 2 21 , \2'+l 

= r [r a z + raz) T 



_ r -2^ r 2 ; (2 ; +l) a 2 i (2'+l) z 2 2 '(2 ; +l) + r 2 2i +l a 2 2i +l z 2 3i +l^ 
. -2 l I 2 l+1 2 l+1 2 2l +2 l i 2 l +l 2 l +l 2 l +l\ 

+r [r a z+raz) 

2 2i 2 l (2 l +l) 2 2l (2 l +l) , 2 2i -2'+l 2 2i +l 2 3i +l , 2 l 2 l+1 2 2l +2 l , 2 ! +l 2 l +l 

= r a v ^ ' z v T ; + r ^ a ^ z ^ + r a z + ra ^ z T 
= cfP+Du** + a 22i+1 f/ 22; - 2i+1 + a 2!+1 t/ 2 ' + a^f/ . 

From now on assume z ^ 0. Since a~ 2 = [7 2 + U we have 

1 = a 2 U 2 +a 2 U 

= a *JJ* + G 2 2 '+2' +lf/ 2- + a 2- + 2' + l f/ 2 2 '-2'+l + + a^+l^ 

which leads to 

a 2-+2<+ lf/ 2 2 < + ^+1+1^-*+! + {a * + a W + * )V * + a 2^ + l V + ! = . 

Substituting V = at/ and multiplying by b = a _2 ' +1 , simplifies the equation to 

v 2 ' 21 + v 22! - 2i+1 + (1 + b)V 21 + V + b = 

which after multiplying by V 2,1 gives 

(V 21 +vf +1 + bV 2 \v 21 + 1) = . (16) 



Since 



we obtain 



(V 2 +V) 2+1 _ V2 2l -2 l +l , T/ 2 2i -2 ; +l 

V*(V* + 1) { ' 

\2 2l -2 l +l , T /2 2! -2 i +l , -i _ l 



As proved in [3 Corollary 2], the monomial function f(x) = x 22 - 2l+l is almost 
perfect nonlinear (APN) when gcd(/,m) = 1, which is the case here since I is 
odd and gcd(/, k) = 1. This means that the number of solutions V G GF(2 m ) 
of the latter equation is at most 2 for any b in GF(2 m ). Since V = raz 2 +1 and 
gcd(2' + l,2 m - 1) = 3 it follows that the number of zeros in GF(2 m )* of the 
linearized polynomial L a (z) is at most 6, which implies that the number of zeros 
in GF(2 m ) is 1 or 4 since the zeros of L a (z) form a vector subspace over GF(2 2 ). 
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(ii) Let x = V 2 ' + V and assume z 7^ 0. After rewriting z 2 ' L a (z) = z 2 ( 2 +1 ) + 
x = observe that this implies that x G GF(2 fc ). 
Using ([TBI) we have 

i=l 

1( mod m) . Such an I exists since I is odd, gcd(7, fc) = 1 and therefore, 
= 1. Raising the latter identity to the power 2 l and adding to itself 

2< 2 2l +2 l 1 2 l +l 2 I ~' +1 ') 1 1 2 l 

C X ^ + CX ^ = X + X , 

= a 2 ' +1 . Dividing by x 2 ' (1 ^ since otherwise the only zero of 
= 0) implies 

c 2 x 2 + X + CX + 1 = 0. 

By TheoremdJ the latter equation has exactly two roots in GF(2 fc ) if and only 
if TikiRic- 1 )) = Tr k (R(a- 2l+1 )) = Tr k (v ) = and R(a~ 2l+1 ) = v$ +1 is one of its 
roots. From Lemma [3] it also follows that all the roots of this equation have the 
same trace as Vq. Therefore, in the case when Tr^fo) = both roots have trace 
zero. However, since x = V 2 ' + V G GF(2 fc ) and V & GF(2 k ) (recall that V = all 
and U 7^ U) we have 

Tr fc (x) = Y^x T = |> 2H = J2(V 2K ' +1) + V 2H ) 

i=0 i=o i=0 

= V 2U +V^1^ Tr k (v ) , 

where (*) holds since V 2 '" = V 2 ' for odd I and V 2 " + V ^ if V & GF(2 k ). 
Therefore, if Tr^o) = then there is no solutions x G GF(2 fc ) having the form 
x = V 2 +V. We have therefore shown that in the case Tr k (vo) = there are no 
nonzero solutions of L a (z) = in GF(2 m ). □ 



where // = 
gcd(/,m) - 
implies 

where c = 
L a (z) is z 



5 Three- Valued Crosscorrelation 

In this section, we prove our main result formulated in Corollary [TJ We start by 
considering the following exponential sum denoted So (a) that to some extent is 
determined by the following lemma that repeats Lemma 10 in [6j. It is assumed 
everywhere that m = 2k. 
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Lemma 8 (|6J) For an odd k, integer I < k and a £ GF(2 fe ) let Sq(o) be defined 
by 

So (a) = (-l) Tr - ( ^ +1)+Trfc( ^ +1) . 

yeGF(2 m ) 

S (a) = 2 k , 

veGF(2 k ),A a (v)=0 

where A a {y) is defined in (GJ). 

We can now determine So (a) completely in the following corollary. 

Corollary 2 Under the conditions of Lemma\^and, additionally, assuming a ^ 
and gcd(7, k) = 1 let Mi be defined as in < f77]j . Then the distribution of S (a) 
for I even is as follows: 

-2 k+1 if aeM 4 , 
if a £ M 2 , 
2 fe i/ a £ Mi 

and for I odd 

-2 k+2 if aeM 4 , 
2 fc+1 i/ a £ M 2 , 
-2 fc i/ a £ Mi . 

Proof. Let /' = Z -1 (mod /c). The distribution follows directly from Lem- 
mas [3] and M since these imply that for / even 

S ( a ) = 2 k (-lf +1 ^^+ l '(N a - 2) 

and for I odd 

S (a) = 2*(-l) Tt *^)jV a , 

where iV a is the number of zeros of A a (v) in GF(2 fc ) and v = i^a" 1 ). Finally 
using Theorem [1], we get the claimed result. □ 



Lemma 9 Let k be odd and r be a noncube in GF(2 m ) such that r 2k+1 = 1. Let 
also a £ GF(2 fc ) and 

Sl ( a ) = (-l) Tr -^ 2i+1 ) +Tr ^^ +1 ) , 

y eGF(2 m ) 

S 2 (a) = (-l) Trm(r " laj/2i+1)+Trfc(i/2fc+1) 

y eGF{2 m ) 

Then 
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(i) Si(a) = S 2 {a). 

(ii) Furthermore, if, additionally, I is odd with gcd(/, k) = 1 then for i = 1,2 
holds 

S^a) 2 = 2 m T a , 

where T a is the number of zeros in GF(2 m ) of L a (z) defined in (Lfy . 
Proof, (i) Using definitions, straightforward calculations lead to 

S^a) = (-l) Trm ( ra ^ !+1 ) +Trfc ^ 2fc+1 ) 

y£GF(2 m ) 

= E <-u 

2/€GF(2 m ) 

= E (-« 

zeGF(2 m ) 
= ^(a) . 

(ii) First, it can be noticed that here we are with the hypothesis of Lemma [7] 
Item (0J. Using substitution z = x + y we obtain 

] Tr m (ra(x 2l + 1 +y 2l + 1 ))+Tr k (x 2k + 1 +y 2k + 1 ) 



Tr m (r 2fc a 2 V 2!+1)2 VTr fe (?/ 2 ' : + 1 > 2fc ) 



Tr m (r-W ! + 1 )+Tr fc (£ 2fc + 1 ) 



^ m {ra{(z+ y ) 2l +^+ y 2l+1 ))+^Mz+yf k+1 +y 2k+1 ) 



\Tr m {ra(z 2l y+zy 2l +z 2l+1 )+yz 2k )+Tr k (z 2k + 1 ) 



Si(a) 2 = ("tf 

x,y&GF(2™) 

= E 

2/,z<GGF(2 m ) 

= E 

i/,2GGF(2 m ) 

_ ^_^Tr m (m2 2i+1 )+Tr fc ( 2 ; 2fc + 1 ) ^ (_l)TW/r i.: 2 " ' ' +'•-'•'- +'•«:)> 

zGGF(2 m ) j/GGF(2 m ) 

= 2 m J] 

zGGF(2 m ),L a ( 2 )=0 



NTr m (m Z 2i + 1 )+Tr fc ( Z 2fe + 1 ) 



where L a (z) = z 2 *^ + r 2 ' a 2 ' ' z 2,2 ' + raz. 

It remains to show that f(z) = Ti m (raz 2 +1 ) + Tik{z 2 +1 ) = for any root z 
of L a . If z = then this fact is obvious. If z 7^ then, by (|T5|) from Lemma [TJ 
Tr™(V) = V + V 2 = 1, where = raz 2 +1 implying that Tr m (V) = 1. Moreover, 
multiplying L a (z) = by z 2,1 we obtain V + U 2 ' + z 2 ( 2 + 1 ) = 0. Thus, 

f(z) = 1 + Tr k (z 2k+1 ) = 1 + Tr,(U + V 2 ') . 
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But 



Tr k (V + V 2l ) = 

= (v + ... + V 2i + ... + ^ 2fc " 1 ) + (\/ 2 ' + --- + V 2fc " 1 + --- + \/ 2!+fe - 1 ) 
= (V + V 2 ") + (V + V 2 ") 2 + ... + (V + V 2 ') 2 '" 1 = I (mod 2) = 1 

and thus, f(z) = 0. 

In particular, since Si (a) = ^<, g GF(2 m )( — 7^ the Boolean function f(z) 
can not be balanced. Quadratic functions including those similar to f(z) are 
studied in [12]. □ 

We are now in position to completely determine the distribution of S(a) de- 
fined in (JH) for a £ GF(2 fc )*. Since this is equivalent to the distribution of 
Cd(r) + 1 for r — 0, 1, . . . , 2 fe — 2, our main result in Corollary [T] is a consequence 
of the theorem below. Note that for any d with the prescribed property we have 
gcd(d,2 fc - 1) = 1. 

Theorem 2 Let m = 2k and d(2 + 1) = 2* (mod 2 k — 1) for some odd k and 
integer I with < I < k, gcd(/, k) = 1 and i > 0. Then the exponential sum S(a) 
defined in (fjj for a e GF(2 fc )* (and C d {r) + 1 for r = 0, 1, . . . , 2 k - 2) have the 
following distribution 

— 2 k+1 occurs 2k g -1 times , 
occurs 2 k ~ 1 — 1 times , 
2 k occurs 2_±1 times . 

Proof: To determine the distribution of the crosscorrelation function Cd(r)+1 
we need to compute the distribution of S(a) as in (j3j) for a £ GF(2 fc )*. We divide 
the proof into two cases depending on the parity of I. 

Case 1: (/ even) 

In this case, gcd(2' + 1, 2 m — 1) = 1. Therefore, substituting x = y 2 +1 in the 
expression for S(a) and since d(2 l + l)(2 fc + 1) = 2*(2 fc + 1) (mod 2 m — 1), we are 
lead to 

S(a) = (-l)™ a2/2 +1 ) +Trfc ( y2 +1 ) = S {a) , 

?/eGF(2" 1 ) 

where Sq(o) is defined in Lemma [H The distribution of S(a) for even values of I 
follows, therefore, from the distribution of Sq(o) given in Corollary [2j 
Case 2: (/ odd) 

To calculate S(a), we first observe that gcd(2 ; + 1, 2 m — 1) = 3. Therefore, if 
we let x = y 2 +1 , then x runs through all cubes in GF(2 m ) three times when y 
runs through GF(2 m ). Thereafter, let x = ry 2 +1 , where r is a noncube in GF(2 m ) 
and finally x = r~ l y 2 +1 . When y runs through GF(2 m ) then x will run through 
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GF(2 m ) three times. We select r as a noncube in GF(2 m ) such that r 2k+1 = 1. 
Further, since d(2 l + l)(2 fc + 1) = 2*(2 fc + 1) (mod 2 m - 1), we obtain 



^Tr m (a 3/ 2i + 1 )+Tr fc ( ? /+ 1 ) 



^Tr m (mj / 2i +l)+Tr fe ( ?/ 2fe + 1 ) 



35(a) = £ 

yeGF(2" 1 ) 

+ E (-i: 

i/eGF(2" 1 ) 

+ ^ (_ 1 )Tr m (r- 1 a/+ 1 )+TV fc fe 2fc + 1 ) 
?/€GF(2 m ) 

2 

= ^Si(a) , 

i=0 

where Sj(a) are defined as in Lemmas [8] and [91 

By Lemma i we also have that Si (a) = 5*2 (a) and 

S 1 (a) 2 = 2 m T a , 

where T a is the number of zeros in GF(2 m ) of L a (z) = z 2 + + r 2 a 2 z 2 + raz. 
From Lemma [7J Item (JI]) it follows that T a = 1 or T a = 4 and, therefore, by 
Lemma El we have Si (a) = S 2 (a) = ±2 k or Si (a) = S 2 (a) = ±2 k+1 . 

Case a: In the case when Tr^vo) = 0, where vq = i?(a _1 ) and R(v) is 
defined in (jHJ), which by Theorem (U occurs for 2 k ~ l — 1 distinct values of a G M2, 
it follows from Lemma [7] Item (Jul) that T a = 1. Therefore, by Lemma [9] we 
have S x 2 (a) = 2 m , i.e., Si(a) = S 2 (a) = ±2 k . Since a G M 2 and by Corollary El 
So (a) = 2 fe+1 . Furthermore, since S(a) = (So (a) + Si (a) + S 2 (a))/3 is an integer, 
it follows that only Si (a) = S 2 (a) = — 2 k is possible and, therefore, S(a) = 0. 

Case b: In the case when Tr^-uo) = 1 and A a (v) = a 2 v 2 + v 2 + av + 1 has 
four zeros in GF(2 fc ), which by Theoremdl occurs for (2 fc_1 — l)/3 distinct values 
of a G M 4 , by Corollary [2] we have S (a) = -2 fc+2 . Since Si (a) = S 2 (a) = ±2 fe 
or Si (a) = S 2 (a) = ±2 fc+1 and S(a) is an integer, only two of the four sign 
combinations are possible, leading in this case to S(a) = or S(a) = — 2 k+1 . 

Case c: In the case when Tr^^o) = 1 and A a {y) has one zero in GF(2 fc ), 
which by Theorem (H occurs for {2 k + l)/3 distinct values of a G Mi, Corollary [2] 
gives S (a) = -2 k . Since Si (a) = S 2 (a) = ±2 k or Si (a) = S 2 (a) = ±2 k+1 and 
S(a) is an integer, only two of the four sign combinations are possible, leading to 
5(a) = -2 fc or S(a) = 2 k . 

The three cases above give in total the possible values 0, ±2 k , — 2 k+1 for S(a). 
We next use the expressions for the sum and the square sum of Cdij) + 1 to 
obtain a set of equations to determine the complete correlation distribution. 

Suppose the crosscorrelation function Cd(r) + 1 takes on the value zero r 
times, the value 2 k is taken on s times, the value — 2 k occurs t times and the 
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Table 1: Exponents d giving three- valued crosscorrelation 



m 


Proved in [I] 


Proved in [5] 


Newly found 


6 


3 


3 




10 


11 


7 




14 


43 


15 


27 


18 


171 


31 


103 


22 


683 


63 


231, 365, 411 


26 


2731 


127 


911, 1243, 1639 



value —2 k+1 occurs v times. From Lemma [T] it follows that 

r + s + t + v = 2 k -1 

2 k s - 2 k t - 2 k+l v = 2 k 

2 2k s + 2 2k t + 2 2k+2 v = 2 m (2 k - 1) . 

This implies 

r + s + t + v = 2 k -1 

s - t - 2v = 1 

s + t + Av = 2 k - 1 . 

Since S(a) = ±2 fc is only possible in Case 3, when Tr^o) = 1 and A a (v) has 
one zero in GF(2 fc ), which occurs (2 fc + l)/3 times, we get s + t = (2 k + l)/3. 
From the last equation this leads to v — (2 fc_1 — l)/3 and therefore from the first 
equation r = 2 k ~ 1 — 1. Finally, using the second equation, we get t — and 
s = (2 fc + l)/3. □ 

In the following, we conjecture that all the cases with the three-valued cross- 
correlation fall under the conditions of our main theorem. The conjecture has 
been verified numerically for all m < 26 and these results are presented in Table [TJ 

Conjecture 1 Only those cases described in CorollaryU\ lead to the three-valued 
crosscorrelation between two m-sequences of different lengths 2 m — 1 and 2 k — 1, 
where m = 2k. 

6 Conclusion 

We have identified new pairs of m-sequences having different lengths 2 m — 1 and 
2 k — 1, where m = 2k, with three- valued crosscorrelation and we have com- 
pletely determined the crosscorrelation distribution. These pairs differ from the 
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sequences in the Kasami family by the property that instead of the decimation 
d — 1 we take such a d that d(2 l + 1) = 2* (mod 2 k — 1) for some integer / and 
i > 0, where /c is odd and gcd(7, k) = 1. We conjecture that our result covers all 
the three-valued cases for the crosscorrelation of m-sequences with the described 
parameters. 
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